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TECHNICAL FIELD 

This invention relates to digital goods and content, and more particularly to 
Break-Once, Run-Everywhere (BORE) resistant digital goods configuration and 
distribution methods and arrangements that significantly protect rights associated 
with the distribution and use of digital goods and digital content. 

BACKGROUND 

Digital goods (e.g., software products and the like) and data or digital 
content (e.g., music, video, books, etc.) are often distributed to consumers via 
fixed computer readable media, such as, for example, a compact disc (CD-ROM), 
digital versatile disc (DVD-ROM), soft magnetic diskette, or hard magnetic disk 
(e.g., a preloaded hard drive). More recently, consumers have been able to 
download digital goods and digital content directly to their computers using data 
communication services, such as, for example, those associated with the Intemet. 

One of the on-going concerns with such distribution techniques, however, is 
the need to provide digital rights management (DRM) protection to prevent 
unauthorized distribution, copying and/or illegal operation of, or access to the 
digital good and content. An ideal digital goods distribution system would 
substantially prevent unauthorized distribution/use of the digital goods and 
content. 

Various DRM techniques have been developed and employed in an attempt 
to thwart potential software pirates from illegally copying or otherwise distributing 
the digital goods to others. For example, one DRM technique includes requiring 
the consumer to insert the original CD-ROM or DVD-ROM for verification prior 
to enabling the operation of a related copy of the digital good. Unfortunately, this 
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DRM technique typically places an unwelcome burden on the honest consumer, 
especially those concemed with speed and productivity. Moreover, such 
techniques are impracticable for digital goods that are site licensed, such as, for 
example, software products that are licensed for use by several computers, and/or 
for digita^goods that are downloaded directly to a computer. Additionally, it is not 
overly difficult for unscrupulous individuals/organizations to produce working 
pirated copies of the CD-ROM, for example. 

Another DRM technique includes requiring or otherwise encouraging the 
consumer to register the digital good with the provider, for example, either through 
the mail or online via the Internet or a direct connection. Thus, the digital good 
may require the consumer to enter a registration code before allowing the digital 
good to be ftilly operational or the digital content to be fully accessed. 
Unfortunately, such DRM techniques are not always effective since unscrupulous 
individuals/organizations need only break through or otherwise undermine the 
DRM protections in a single copy of the digital good. Once broken, copies of the 
digital good can be illegally distributed, hence such DRM techniques are 
considered to be Break-Once, Run-Everywhere (BORE) susceptible; 

Consequently, there is need for digital goods configuration and/or 
distribution methods and arrangements that are significantly more BORE-resistant. 
Preferably, the BORE-resistant methods and arrangements will be easy to 
implement and cost effective for the digital good developer and/or the content 
producer, supportive of online distribution and muhiple station licensing, 
traceable, difficult to undermine, and not overly burdensome on the consumer. 
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SUMMARY 

The present invention provides DRM (Digital Rights Management) 
software, distribution methods, and arrangements that are designed to protect 
software, content (e.g., music, video, books, etc.), and other digital goods 
(hereinafter, "digital goods" refers to all the above). The DRM software is 
configured to be resistant to Break Once, Run Everywhere (BORE) attacks. The 
BORE-resistant methods and arrangements are easy and cost effective for the 
digital good developer or content producer to implement, and are not overly 
burdensome on the consumer. The various methods and arrangements support 
traditional and online distribution techniques, and are adaptable for site licensing. 
The resulting digital good is substantially difficult to undermine on any significant 
scale, because each copy is uniquely configured for use by an authorized 
consumer/computer. 

Thus, for example, in accordance with certain aspects of the present 
invention, improved DRM security is provided by individualizing the digital good 
for each consumer using selective program flow manipulation techniques. The 
program-flow-manipulation techniques are combined with encryption and/or 
cryptography keying techniques or other unique/trusted identifying techniques to 
individualize the configuration of a digital good for each authorized consumer. 

The digital good can be distributed in one or more parts that are selectively 
modified and/or otherwise provided to an authorized consumer having the 
applicable security keys and/or other unique/trusted identifier information needed 
to complete the configuration of an individualized and operatively unique 
modified digital good. 



Ue A Hayes. PLLC 



3 



03NO0U33 MSI'394US.PA T.APP.DOC 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 



The modified digital good is unique for each consumer/computer, because 
the security keys and/or other unique/trusted identifiers are used as inputs during 
program flow manipulation within the source's/consumer's computer. Subsequent 
initialization/operation of the uniquely configured modified digital good can 
include verifying the presence of certain consumer/computer identifying data to 
further promote DRM protection. Consequently, the modified digital good and the 
distribution techniques are substantially less susceptible to BORE tampering. 

By way of example, the above stated needs and others are met by a method 
that includes providing an initial digital good to at least one computer. The initial 
digital good is converted into a modified digital good using unique key data to 
selectively manipulate at least one flow control operation within the initial digital 
good, such that the modified digital good is operatively different in configuration, 
but substantially functionally equivalent to the initial digital good. 

The unique key data can be based on at least one unique identifier data 
associated with a destination computer. For example, a source computer can 
cryptographically generate the unique key data based on the unique identifier data 
provided by the destination computer and a secret encryption key. The method 
can include selectively limiting operation of the modified digital good to 
computers that are properly associated with at least the unique identifier data 
and/or unique key data. 

The method can also include dividing the initial digital good into at least a 
first portion and a second portion using the source computer. The first portion is 
provided to the destination computer via a first computer readable medium, and a 
modified second portion to the destination computer via a second computer 
readable medium. Thus, for example, the first computer readable medium may 
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include a fixed computer readable medium, while the second computer readable 
medium may include a network communication. The first portion is manipulated 
or modified by the destination computer using a first key. Similarly, the source 
computer manipulates the second portion using a second key. 

When the initial digital good has been split into first and second portions, 
then the modified digital good would therefore include a combination of the 
modified first portion and the modified second portion. Since these portions were 
operatively reconfigured using related keys/techniques, the modifications made to 
each portion can be selected to match the modifications in the other. 

Another aspect that is described herein is an arrangement that includes an 
identifier configured to output unique identifier data associated with a computer, 
and a key generator that is coupled to receive the unique identifier data and 
generate at least one unique key data based on the received unique identifier data. 
The arrangement also includes at least one individualizer that is configured to 
receive the unique key data and at least a portion of an initial digital good, and 
output at least a portion of a modified digital good using the unique key data to 
selectively alter the initial digital good. Consequently, the modified digital good 
will be operatively different in configuration, but substantially fiinctionally 
equivalent to the initial digital good. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram depicting an exemplary network suitable for use 
with the present invention. 

Fig. 2 is a block diagram depicting an exemplary computer system suitable 
for use in the network of Fig. 1 . 

Fig. 3 is a block diagram depicting an exemplary BORE-resistant digital 
good configuration and distribution arrangement suitable for use within the 
network of Fig. 1, in accordance with certain aspects of the present invention. 

Fig. 4 is a block diagram depicting another exemplary BORE-resistant 
digital good configuration and distribution arrangement suitable for use within the 
network of Fig. 1, in accordance with certain further aspects of the present 
invention. 

Fig. 5 is a block diagram depicting yet another exemplary BORE-resistant 
digital good configuration and distribution arrangement suitable for use within the 
network of Fig. 1, in accordance with certain additional aspects of the present 
invention. 

Fig. 6 is a block diagram that illustratively depicts certain exemplary 
features of a BORE-resistant digital good as configured and distributed, for 
example, by the arrangement in Fig. 3. 

Fig. 7 is a flow-chart depicting an exemplary process for providing a 
BORE-resistant digital good to the computer system of Fig. 2. 

Fig. 8 is a flow-chart depicting an exemplary process for configuring a 
BORE-resistant digital good using the computer system of Fig. 2. 

Fig. 9 is a flow-chart depicting an exemplary process for operating the 
computer system of Fig. 2 using a BORE-resistant digital good. 
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DETAILED DESCRIPTION 

Fig. 1 is a block diagram depicting an exemplary computer network 20 that 
is suitable for use with the various methods and arrangements in accordance with 
the present invention. 

Computer network 20 includes a plurality of host or customer computers 22 
coupled to at least one communications network 24. Communication network 24 
is further coupled to at least one source or digital good provider computer 26. 
Computers 22 and 26 are configured to communicate with each other over 
communications network 24. By way of example, communications network 24 
can include a public network such as the Internet. Communications network 24 
might also include local-area networks, private wide-area networks, direct dial-up 
links, and the like. 

In the discussion below, certain aspects of the present invention will be 
described in the general context of computer-executable instructions, such as 
program modules, being executed by one or more conventional personal 
computers. Generally, program modules include routines, programs, program 
segments, objects, components, data structures, etc. that perform particular tasks 
or implement particular abstract data types. Moreover, those skilled in the art will 
appreciate that the invention may be practiced with other computer system 
configurations, including hand-held devices, multiprocessor systems, 
microprocessor-based or programmable consumer electronics, network PCs, 
minicomputers, mainframe computers, and the like. In a distributed computer 
environment, program modules may be located in both local and remote memory 
storage devices. 
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Fig. 2 is a block diagram depicting a computer 102 that can be included in 
customer computer 22 and/or provider computer 26, for example. Computer 102 
includes one or more processors or processing units 104, a system memory 106, 
and a bus 108 that couples various system components including the system 
memory 106 to processors 104. 

Bus 108 represents one or more of any of several types of bus structures, 
including a memory bus or memory controller, a peripheral bus, an accelerated 
graphics port, and a processor or local bus using any of a variety of bus 
architectures. The system memory includes read only memory (ROM) 110 and 
random access memory (RAM) 112. A basic input/output system (BIOS) 114, 
containing the basic routines that help to transfer information between elements 
within computer 102, such as during start-up, is stored in ROM 110. Computer 
102 further includes a hard disk drive 116 for reading from and writing to a hard 
disk, not shown, a magnetic disk drive 118 for reading from and writing to a 
removable magnetic disk 120, and an optical disk drive 122 for reading from or 
writing to a removable optical disk 124 such as a CD ROM, DVD ROM or other 
optical media. The hard disk drive 116, magnetic disk drive 118, and optical disk 
drive 122 are connected to the bus 108 by an SCSI interface 126 or some other 
appropriate interface. The drives and their associated computer-readable media 
provide nonvolatile storage of computer readable instructions, data structures, 
program modules and other data for computer 102. Although the exemplary 
environment described herein employs a hard disk, a removable magnetic disk 120 
and a removable optical disk 124, it should be appreciated by those skilled in the 
art that other types of computer readable media which can store data that is 
accessible by a computer, such as magnetic cassettes, flash memory cards, digital 
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video disks, random access memories (RAMs) read only memories (ROM), and 
the like, may also be used in the exemplary operating environment. 

A number of program modules may be stored on the hard disk, magnetic 
disk 120, optical disk 124, ROM 110, or RAM 112, including an operating system 
130, one or more application programs 132, other program modules 134, and 
program data 136. A user may enter commands and information into computer 
102 through input devices such as keyboard 138 and pointing device 140. Other 
input devices (not shown) may include a microphone, joystick, game pad, satellite 
dish, scanner, or the like. These and other input devices are connected to the 
processing unit 104 through an interface 142 that is coupled to the bus 108. A 
monitor 144 or other type of display device is also connected to the bus 108 via an 
interface, such as a video adapter 146. In addition to the monitor, personal 
computers typically include other peripheral output devices (not shown) such as 
speakers and printers. 

Computer 102 can operate in a networked environment using logical 
connections to one or more remote computers, such as a remote computer 148. 
Remote computer 148 may be another personal computer, a server, a router, a 
network PC, a peer device or other common network node, and typically includes 
many or all of the elements described above relative to computer 102, although 
only a memory storage device 150 has been illustrated in Fig. 2. The logical 
connections depicted in Fig. 2 include a local area network (LAN) 152 and a wide 
area network (WAN) 154. Such networking environments are commonplace in 
offices, enterprise-wide computer networks, intranets, and the Internet. 

When used in a LAN networking environment, computer 102 is connected 
to the local network 152 through a network interface or adapter 156. When used 
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in a WAN networking environment, computer 102 typically includes a modem 158 
or other means for establishing communications over the wide area network 154, 
such as the Intemet. Modem 158, which may be internal or external, is connected 
to the bus 108 via a serial port interface 128. In a networked environment, 
program modules depicted relative to the personal computer 102, or portions 
thereof, may be stored in the remote memory storage device. It will be 
appreciated that the network connections shown are exemplary and other means of 
establishing a communications link between the computers may be used. 

Generally, the data processors of computer 102 are programmed by means 
of instructions stored at different times in the various computer-readable storage 
media of the computer. Programs and operating systems are typically distributed, 
for example, on floppy disks or CD-ROMs. From there, they are installed or 
loaded into the secondary memory of a computer. At execution, they are loaded at 
least partially into the computer's primary electronic memory. The invention 
described herein includes these and other various types of computer-readable 
media when such media contain instructions or programs for implementing the 
steps described below in conjunction with a microprocessor or other data 
processor. The invention also includes the computer itself when programmed 
according to the methods and techniques described below. Furthermore, certain 
sub-components of the computer may be programmed to perform the functions 
and steps described below. The invention includes such sub-components when 
they are programmed as described. In addition, the invention described herein 
includes data structures, described below, as embodied on various types of 
memory media. 
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For purposes of illustration, software programs and other executable 
program components such as the operating system are illustrated herein as discrete 
blocks, although it is recognized that such programs and components reside at 
various times in different storage components of the computer, and are executed 
by the data processor(s) of the computer. 

Reference is now made to Fig. 3, which is a block diagram depicting an 
exemplary arrangement 200 that includes consumer computer 22 and provider 
computer 26 and is configured to distribute and/or otherwise provide digital goods 
to consumer computer 22 in a BORE-resistant manner. Here, a digital good "P" 
202 is initially arranged within provider computer 26. Digital good P 202 can 
include one or more computer programs, applications, operating systems, various 
modules, fiinctions, and/or content (e.g., music, video, books, etc.) and/or other 
types of digital data, for example. Provider computer 26 is tasked to provide 
digital good P 202 or an equivalent form thereof to consumer computer 22, such 
that the resulting digital good on consumer computer 22 will be significantly 
BORE resistant. 

This is accomplished, in this example, by arranging provider computer 26 
to deliver digital good P 202 in at least two stages. In a first stage, a first portion 
"PI" 206 of digital good P 202 is delivered to consumer computer 22, for 
example, via a CD ROM, DVD ROM, removable magnetic disk, preloaded on a 
hard disk drive, solid-state memory device, a network connection, other 
conventional computer readable media, or the like. In a second stage, a second 
portion "P2" 207 of digital good P 202 (e.g., P = PI + P2) is converted to a 
modified second portion "Q2" based on identifying information provided by 
consumer computer 22. The modified second portion Q2 is provided to consumer 
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computer 22. While modified second portion Q2 can be provided to consumer 
computer 22 via any traditional/conventional computer readable medium, in this 
example, modified second portion Q2 is provided to consumer computer 22 via a 
network connection that allows for timely delivery. 

Consumer computer 22, having received first portion PI 206, converts first 
portion PI 206 to a modified first portion "Ql" using information provided by 
provider computer 26. Consumer computer 22 is then able to combine modified 
first portion Ql with modified portion Q2 to produce a uniquely configured 
modified digital good "Q" 218 (e.g., Q = Ql + Q2) that is fiincdonally equivalent 
to digital good P 202. 

With this basic process in mind, referring to Fig. 3, in this exemplary 
arrangement digital good P 202 is split or otherwise divided into at least two 
portions, e.g., PI and P2, by a splitter 204. First portion PI 206 is provided to an 
individualizer 208 within consumer computer 22. Second portion P2 207 is 
provided to an individualizer 214 within provider computer 26. . By way of 
example, individualizers 208 and 214 may include a program flow manipulator or 
other like mechanism that allows the respective portions of digital good P 202 to 
be operatively, functionally, sequentially, associatively, or otherwise individualized 
based at least in part on one or more inputs. Here, for example, keys Kl and K2 
are generated and/or otherwise provided to their respective individualizers 208 and 
214 and used to "individualize" portions PI and P2, respectively. 

An identifier 210 within consumer computer 22, which may be 
implemented in hardware and/or software, is essentially configured to uniquely 
identify consumer computer 22 in some manner. By way of example, identifier 
210 can include circuitry and/or functions that output unique identifying data 
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associated with processing unit 104, operating system 130, application programs 
132, other modules 134, program data 136, other resources/subsystems within 
computer 102, or coupled therewith. Identifier 210 may include information 
associated with the consumer. For example, client identifier 210 might include 
name, address, telephone, credit card, and/or other similar data. This and other 
identifying information may be provided by one or more (optional) extemal 
sources 211 to identifier 210 and/or provider computer 26. For example, extemal 
sources 211 may include one or more computers, databases, human operators, etc., 
which provide the requisite identifying information to arrangement 200. 

As shown, in this example the data output from client identifier 210 and/or 
(optional) extemal sources 211 is provided to a key generator 212 within provider 
computer 26. Key generator 212 is configured to generate one or more 
cryptographically related encryption keys based at least in part on the identifying 
information/data from client identifier 210 and/or extemal sources 211. Here, key 
generator 212 generates two keys Kl and K2, which are cryptographically related 
to a secret key K and at least a portion of the data from client identifier 210. 
Consequently, keys Kl and K2 include data that is uniquely associated with 
consumer computer 22 and/or the consumer associated therewith. Conventional 
data encryption techniques are employed to insure that keys Kl and K2 cannot be 
easily determined without access to secret key K. Once generated, key Kl is 
provided to individualizer 208 within consumer computer 22, and key K2 is 
provided to individualizer214 within provider computer 26. 

Individualizer208, having received key Kl, selectively individualizes first 
portion PI based on key Kl. When a program flow manipulator is employed, for 
example, this can include rearranging at least one program section, block of code, 
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pointer, address, adding/deleting code, etc., as definable within a program flow- 
graph associated with first portion PI. Preferably, several modifications occur 
within individualizer 208 to cause the resulting modified first portion Ql to be 
uniquely associated with key Kl and distinctly different fi-om first portion PI 206. 
Data from key Kl may be included within modified portion Ql. Modified first 
portion Ql is then provided to a combiner 216. 

Similarly, individualizer 214, having received key K2, selectively 
individualizes second portion P2 based on key K2. Again, when a program flow 
manipulator is employed, for example this can include rearranging at least one 
program section, block of code, pointer, address, adding/deleting code, etc., as 
definable within a program flow-graph associated with second portion P2. 
Preferably, several modifications occur within individualizer 214 to cause the 
resulting modified second portion Q2 to be uniquely associated with key K2. 
Modified second portion Q2 is then provided to combiner 216 within consumer 
computer 22. 

Combiner 216 is configured to combine modified first portion Ql and 
modified second portion Q2 to produce a modified digital good Q 218. Modified 
digital good Q 218 is operatively configured to run within consumer computer 22. 
Modified digital good Q 218 can be further configured to verify that information 
from client identifier 210 matches related information, for example, data 
associated with key Kl, as incorporated in modified digital good Q 218. Thus, 
modified digital good Q 218 can be designed to verify that the host computer that 
it is running on, or attempting to be run on, is indeed authorized to do so. 

In this manner, arrangement 200 causes the resulting configuration of 
modified digital good Q 218 to be substantially unique for each particular 
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computer and/or consumer. Arrangement 200 is significantly BORE resistant, 
since the security features of each unique implementation of modified digital good 
Q 218 are inherently unique and would require potential hackers to expend a great 
deal of effort to discover, override and/or otherwise disable the features. Thus, 
rather than posing a "break once" situation, the present invention would require 
hackers to "break each" modified digital good Q 218. 

Additional security features can also be included or otherwise incorporated 
in modified digital good Q 218, such as, for example, various encryption, data 
hiding and/or fingerprinting techniques can be employed to further discourage 
unauthorized use or distribution. Thus, with respect to Fig. 3, for example, digital 
good P 202 can be further pre-processed prior to being provided to splitter 204. 
Portions PI 206 and/or P2 207 can be further post-processed prior to being 
supplied to individualizers 208 and 214, respectively. Similarly, additional 
pre/post-processing can be conducted on modified first portions Ql and/or Q2. 
Such security features may include local data such as, for example, time and date, 
serial numbers, random numbers, other public/private keys, digital certificates, 
digital signatures, etc. In certain configurations, provider computer 26 may also 
store certain types of information in a local database (not shown). 

Those skilled in the art will recognize that the processing described above 
can be selectively distributed and/or scheduled as needed. Indeed, in certain 
arrangements, processes that are computationally intensive may be completed 
offline or on other computers (not shown). Thus, for example, if individualizer 
208 includes a program flow manipulator, it may be prudent to run the program 
flow manipulator on another computer rather than tie up consumer computer 22. 
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In other arrangements, splitter 204 may also be provided through one or more 
other computers. 

In accordance with certain further aspects, arrangement 200 of Fig. 3 can 
even be employed when either first portion PI 206 or second portion P2 207 
contains no data (i.e., P1=P, or P2=P). 

Exemplary implementations in such cases are depicted in Figs 4 and 5, as 
described below. Basically, if either first portion PI 206 or second portion P2 207 
contains no data, then certain functionality within arrangement 200 of Fig. 3 can 
be eliminated or otherwise ignored. 

Fig. 4 is a block diagram depicting another exemplary arrangement 220, in 
accordance with certain further aspects of the present invention. As shown, in this 
example, digital good P 202 is not split into portions. Instead, digital good P 202 
is provided to individualizer 208. Key generator 212 is configured to generate key 
Kl based on data from identifier 210. Key Kl is then provided to individualizer 
208. Individualizer 208 converts digital good P 202 into modified digital good Ql 
218. 

Fig. 5 is a block diagram depicting yet another exemplary arrangement 230. 
As shown, in this example, digital good P 202 is not split into portions. Instead, 
digital good P 202 is provided to individualizer 214. Key generator 212 generates 
key K2 based on data from identifier 210. Key K2 is provided to individualizer 
214. Individualizer 214 then converts digital good P 202 into a modified digital 
good Q2 218. Modified digital good Q2 218 is then provided to consumer 
computer 22. 

Fig. 6 is a block diagram that illustratively depicts certain exemplary 
features of a BORE-resistant. digital good as configured and distributed, for 
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example, by arrangement 200 in Fig. 3, as described above. In this example, 
digital good P 202 includes a plurality of segments or blocks 240 that are 
operatively or associatively configured together in some manner, for example, as 
represented by the interconnecting arrows between various blocks. Thus, for 
example, the arrow between "block A" and "block B" can represent a calling 
function, a pointer, data passing, a content sequence, a content ordering, or the 
like. 

As shown, digital good P 202 has been selectively split into a first portion 
PI 206 and second portion P2 207. Here, first portion PI 206 includes "block A", 
"block B", "block C", "block D", and "block G". Second portion P2 207 includes 
"block E", "block F", "block H", and "block F'. 

As a result of arrangement 200, in Fig. 3, for example, a modified digital 
good Q 218 has been created as shown at the bottom of Fig. 6. Here, the blocks 
240 have been rearranged as blocks 242, and operatively or associatively 
reconfigured as represented, for example, by arrows 244a-c. This produces a 
functionally equivalent version of digital good P 202. Thus, for example, arrow 
244a illustrates that "block F' and "block G" are now operatively or associatively 
coupled, arrow 244b illustrates that "block F" and "block H" are now operatively 
or associatively coupled, and arrow 244c illustrates that "block H" and "block D" 
are now operatively or associatively coupled, where they were not previously. 
Similarly, the absence of an arrow between "block A" and "block B" represents 
that they are no longer directly operatively or associatively coupled as before, but 
rather "block C" has been introduced there between. 

Those skilled in the art will recognize that a variety of different 
permutations are available in configuring digital good P 202 into corresponding 
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modified digital good Q 218, and that certain configurations will be more optimal 
than others. For this reason and others, splitter 204, individualizers 208 and 214, 
and/or combiner 216 can be further arranged to configure digital good Q 218 to 
meet certain performance goals, as well as DRM goals. 

Fig. 7 is a flow-chart depicting an exemplary process 300 for providing a 
BORE-resistant digital good to a computer 102, as in Fig. 2, for example, using 
arrangement 200, In step 302, the digital good provider (e.g., a vendor) supplies a 
first portion PI 206 of a digital good P 202 to a consumer. In step 304, the 
consumer supplies requisite identifying information to the vendor. In step 304, the 
vendor may also or optionally access identifying information within additional 
external resources. Next, in step 306, the vendor generates cryptographically 
related keys Kl and K2 based at least in part on the identifying information in step 
304. 

In step 308, the vendor individualizes at least part of a second portion P2 of 
digital good P 202, using key K2. This results in a modified second portion Q2. 
The vendor provides modified second portion Q2 and key Kl to the consumer. 

In step 310, the consumer individualizes first portion PI 206 using key Kl, 
which results in a modified portion Ql. Next, in step 312, the consumer combines 
modified first portion Ql and modified second portion Q2 to produce a modified 
digital good Q 218, which a uniquely and operatively associated with the 
consumer and substantially functionally equivalent to digital good P 202. 

Fig. 8 is a flow-chart depicting an exemplary process 400 for configuring a 
digital good using the BORE-resistant techniques as described above. In this 
example, the digital good is assumed to be a software program. In step 402, a first 
plurality of program segments associated with digital good P 202 are provided. In 
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Step 404, unique key data associated with an identifiable computer/consumer is 
provided. Next, as shown in step 406, at least a portion of a program flow within 
the first plurality of segments is modified based on the unique key data. In step 
408, a unique digital good is provided for use by the identifiable 
computer/consumer, using at least the modified first plurality of segments from 
step 406. 

Fig. 9 is a flow-chart depicting an exemplary process 420 for operating a 
computer 102, as in Fig. 2, for example, using a BORE-resistant digital good that 
has been configured using the BORE-resistant techniques as described above. 
Here, in step 422, a uniquely configured digital good is provided for use by an 
identifiable computer/consumer. In step 424, unique key data associated with the 
identifiable computer/consumer is also provided. Next, in step 426, the uniquely 
configured digital good is selectively verified, using the unique key data, as being 
properly associated with an identifiable computer/consumer running or attempting 
to run the unique configuration digital good. The uniquely configured digital good 
will be unable to properly/fully fiinction, or to be otherwise fiilly accessed, if the 
identifiable computer/consumer cannot be properly verified in step 426. 

The preceding exemplary methods and arrangements may be implemented 
in an automated and controlled manner, such that neither the consumer nor the 
digital good provider is overly burdened. 

Although the invention has been described in language specific to structural 
features and/or methodological steps, it is to be understood that the invention 
defined in the appended claims is not necessarily limited to the specific features or 
steps described. Rather, the specific features and steps are disclosed as preferred 
forms of implementing the claimed invention. 
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